Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c4a9740 authored by Nirmal Abraham's avatar Nirmal Abraham
Browse files

fbdev: msm: Handle rotator init failure correctly 



In case 'mdss_rotator_req_init' function fails, the
error handling code frees the 'req' struct which
is not yet allocated. Correct this error scenario
by freeing the 'req' struct only for cases where it
is already allocated.

Change-Id: If9089c59497fef628528e6a462eb5a4699453214
Signed-off-by: default avatarNirmal Abraham <nabrah@codeaurora.org>
parent bc4eb225

drivers/video/fbdev/msm/mdss_rotator.c

+8 −6
Original line number Diff line number Diff line
@@ -2223,14 +2223,16 @@ static int mdss_rotator_handle_request(struct mdss_rot_mgr *mgr, 
	ret = copy_from_user(items, user_req.list, size);

	if (ret) {

		pr_err("fail to copy rotation items\n");

		goto handle_request_err;

		kfree(items);

		return ret;

	}



	req = mdss_rotator_req_init(mgr, items, user_req.count, user_req.flags);

	if (IS_ERR_OR_NULL(req)) {

		pr_err("fail to allocate rotation request\n");

		ret = PTR_ERR(req);

		goto handle_request_err;

		kfree(items);

		return ret;

	}



	mutex_lock(&mgr->lock);
@@ -2269,7 +2271,6 @@ static int mdss_rotator_handle_request(struct mdss_rot_mgr *mgr, 


handle_request_err1:

	mutex_unlock(&mgr->lock);

handle_request_err:

	kfree(items);

	kfree(req);

	return ret;
@@ -2388,7 +2389,8 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr, 
	ret = copy_from_user(items, compat_ptr(user_req32.list), size);

	if (ret) {

		pr_err("fail to copy rotation items\n");

		goto handle_request32_err;

		kfree(items);

		return ret;

	}



	req = mdss_rotator_req_init(mgr, items, user_req32.count,
@@ -2396,7 +2398,8 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr, 
	if (IS_ERR_OR_NULL(req)) {

		pr_err("fail to allocate rotation request\n");

		ret = PTR_ERR(req);

		goto handle_request32_err;

		kfree(items);

		return ret;

	}



	mutex_lock(&mgr->lock);
@@ -2435,7 +2438,6 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr, 


handle_request32_err1:

	mutex_unlock(&mgr->lock);

handle_request32_err:

	kfree(items);

	kfree(req);

	return ret;